bull-bullmq-nestjs
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes instructions to fetch authentication tokens from the Google Cloud metadata service (metadata.google.internal). This is a standard and secure practice for service-to-service authentication within GCP environments.
- [CREDENTIALS_UNSAFE]: Instructions correctly emphasize security best practices by recommending that sensitive data, such as Firebase service account certificates, be loaded via environment variables rather than being hardcoded in the source code.
- [INDIRECT_PROMPT_INJECTION]: The architecture includes an attack surface for indirect injection via job payloads; however, the skill provides mitigation guidance, such as implementing Authorization header validation for internal endpoints and using deterministic, sanitized job IDs.
- [COMMAND_EXECUTION]: References standard installation commands for well-known and reputable libraries from the official NPM registry, such as BullMQ, Firebase Admin, and Google Cloud Tasks SDKs.
Audit Metadata